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MEMORANDUM FOR: Director of Central Intelligence 


SUBJECT : Survey of Personnel Security 


1, In accordance with your instruction of 27 September 1963, 
I have had.a survey made of the status of personnel security within 
CIA. The report of my findings is attached at Tab A. The report 
is summarized in the paragraphs that follow, and recommendations 
appear in paragraph 15, 

Purpose of the Survey 

2. The purpose of the survey was to determine whether CIA 
regulations and procedures for maintaining personnel security 
(a) are adequate; (b) are known, understood, and followed; and (c) 
are effective. 

Scope of the Survey 

3. We interviewed the Director of Seeunity and certain of his 
senior officers, the Director of Personnel, the Chief of the Medical 
Staff; the Chief of the Counterintelligence Staff, and a cross-section 
of office heads within the DD/I, DD/S, DD/P, and DD/S&T. We asked 
office heads to identify to us strong and weak supervisors, without 
specifying: which was which. We interviewed in excess of 40 super-~ 
= Saah oueacenting a wide range of grades and of responsibilities. 
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We asked the Director of Personnel, the Chief of the Medical Staff, 
and supervisors to identify to us personnel who had married, 
traveled abroad, taken external training, written for publication, 
taken extended leave, or had any sort of personal experience that 
required the attention of the Office of Security. We then reviewed 
the security files of these individuals--some 40 in all. We also 
inquired at some length into the polygraph program, the security 


reinvestigation program, the security research program, and into 


the activities of the Personnel Security Division in general. Members 


of my staff now inspecting CIA installations in the Far East have been 
instructed to take particular note of personnel security and to report 
their findings to the Chief of Station. Preliminary reports from 
stations inspected to date have been generally favorable. The details 
of findings will be available upon the return of the inspectors to 
Headquarters. 
Summary of Findings 

4. The results of our investigation support the conclusion that 
the quality of personnel security in CIA is excellent. This does not 
rule out the possibility of a defection from our ranks to the opposition. 
Those interviewed were virtually unanimous in agreeing that no system 


of security controls can be devised that would detect, with certainty 


EN Des 


Approved For Release maa of 6 : CIA-RDP84-00780R000500090020-8 


ECRET 


SECRET 


Approved For Release 2002/08/15 : CIA-RDP84-00780R000500090020-8 


and in advance, the sudden decision to defect. Experience has demon- 
strated, however, that the poor security risk becomes so through the 
cumulative effect of a combination of personal and official circum- 
stances and that these circumstances are discernible. 

5. The primary safeguard against the poor security risk is 
pre-employment screening. This involves a thorough check of 
qualifications, suitability, and security acceptability. The job is done 
conscientiously, and I am convinced that we. have an effective program 
for identifying and disqualifying the individual with potential security 
vulnerabilities. The fact that subsequent security reinvestigations 
on a fairly large scale have discovered almost no "bad apples" is a 
good measure of the effectiveness of pre-employment procedures. 

Of particular significance in this regard is the fact that the Office of 
Security over the years has resisted pressures to accept for employ- 
ment individuals on whom the initial security investigation had not 
been combleted. 

6. Once the individual passes the major barrier of the initial 
security investigation and is employed, he is thereafter subjected to 
a series of lesser hurdles that permit repeated reviews of the status 
of his security. For example, he must report marriage, private 
foreign travel, private external training, the joining of clubs or organi- 


zations, writing for publication, part-time employment, etc. Each of 
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these acts requires the approval of the Office of Security and each 
involves a review of his accumulated security file. At Tab C is a list 
of actions that require security approval. The review of files, selected 
by ourselves rather than the Office of Security, revealed no instance of 
non-compliance with these requirements. 

7. The Security -réinvestigation program that has been under 
way for over two years is a sound innovation. It supplements the 
reinvestigations that result from reviews of accumulated security files, 
from major changes in assignment, or from a change in the employee's 
clearance status (e.g., AEC, SI, TKH). The program is going slowly 
because of the press of current work. The program is pursued during 
slack periods and set aside during heavy workload periods. The near- 
zero rate of unfavorable findings suggests that the reinvestigation 
program can safely be pursued at its present level. 

8. The work of the Security Research Staff is particularly note- 
worthy. It concerns itself with problems having possible counter- 
‘intelligence implications. It can and does take the time to inquire in 
depth, to review, and to analyze. It provides an additional check on 
the effectiveness of routine personnel security measures. 

9. The Agency's polygraph program is one of our major security 
strengths. The degree to which it is accepted by Agency employees stems 
largely from the care with which the program is administered. It was 
initiated only after a careful R&D effort and lengthy experimentation 
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with volunteers; it is used as an aid to investigation and with dis- 
crimination; the polygraph records are maintained separately within 
the Office of Security. A memorandum prepared by the Director of 
Security regarding the polygraph program appears at Tab B. 

10. Much of the effectiveness of the Agency's security program 

stems from the fact that it is centrally controlled and administered 

® 
by the Office of Security. The Office is staffed with professionals who 
have made a career of security. The decisions that must be made in 
cases where security is the paramount issue are made by those who 
are best qualified by training and experierice to make them. Asa 
corollary, the inviolability of security files is a strong plus. The 
‘employee who comes into possession of information with security 
implications can pass it on to the Office of Security knowing that it 
will be tightly held and appropriately used. 

ll. We seriously doubt that high security standards result 
solely from regulations or procedures administered by the Office of 
Security. Good personnel security results from the cooperation of 
all concerned. We were particularly impressed with the extent of 
coordination, often informal and not covered by regulations, that 
exists among the Office of Security, the Office of Personnel, and the 


Medical Staff. There are, of course, problem cases that are almost 


solely the concern of Security. Often, however, the problems are of 
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concern to all three and solutions are found through the ad hoc com- 
mittee approach. 

12. As is apparent from the above, we found much to commend 
in the personnel security program as it is administered by professionals 
who devote their full time to it. We found much less consistency at 
the level of the supervisor who concerns himself with the security 
of his employees only "in addition to his other duties." In general, 
we found that the strong supervisor took serious account of personnel 
security; the weak supervisor did not. Supervisory weaknesses as 
regards personnel security are most pronounced among supervisors 


of relatively low GS grade. In my opinion, there is need for a pro- 


gram of indoctrination and .reindoctrination of supervisors in their 


responsibilities as supervisors, including their responsibility in 


personnel security matters, and I have so recommended in 


ai dee an iS; 

13. We found other relatively minor weaknesses in the 
personnel security picture--some of which can be improved upon, 
some of which have no easy solution. For those to which we do 
see possible solutions, recommendations appear in paragraph 15, 

a. The first barrier to penetration is the concealment 
of the identities of our personnel. There has been a 


progressive erosion of security in this regard. 
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INTRODUCTION 


1, The fact that emerges most clearly from this survey is 
that personnel security cannot be dealt with as an entity unto itself. 
We seriously doubt that high security standards can be attained 
solely through the deterrent effect of regulations or procedures 
administered by the Office of Security and by management. Good 
personnel security results in part from the cooperation of all 
concerned, Personnel security, employee morale, and the Agency 
image are inseparably bound together. The individual with good 
morale, engendered by respect for his Agency, will do his best 
to protect the public image of the Agency. This admittedly is an 
intangible factor, but we firmly believe that it is central among 
the many factors that combine to yield a good security posture in 
an organization. 

Zz. It is axiomatic that the requirements of security must 
be balanced against the reasonable requirements of management. 
Total security would impose impossible limitations on the efficiency 
of the organization. As one security officer pointed out, total 
security would make it impossible to hire employees, to allow them 
to engage in operations, to publish the results of their activities or 
to permit them to resign once employed. We do not and could not 


aspire to total security. Our open society has an inherent resistance 
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to police-state measures. The existence of narrow and rigid security 
restrictions would not only have an undesirably inhibiting effect on 
many employees but would make it impossible for us to hire persons 
having the qualities we seek. To meet these complex problems, the 
Office of Security has developed a philosophy that seeks to engender 
a sense of security responsibility in our employees, in whom consid- 
erable trust is then placed. This principle is perhaps easier to 
enunciate than it is to describe, but we believe that the evidence 
set forth in later paragraphs makes it clear that this philosophy 


does exist and that it is effective. 


CIA SECURITY REGULATIONS 

3, Attached at Tab C is an outline of the Agency's personnel 
security program, listing the specific regulations that apply to each 
aspect of the program. It is clear that the regulations are compre- 
hensive. They have been kept current. The regulation on employee 
conduct{ fox example, which covers such subjects as 
on- and off-the-job conduct, political activity, conflicts of interest, 
foreign awards and gifts, and marriage of employees, is now in 
the process of being rewritten. 

4, The substance of the regulations is important. The 
restrictions imposed upon the employee and the requirement that 
he report certain acts do have a deterrent effect. We believe, 
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however, that the philosophy behind the regulations is of even more 


importance than their substance. 


a. The regulations concentrate on the "soft" spots in 
the employee's career from the standpoint of security--those 
changes in his official or private life that may directly or 
indirectly affect his security status. 

b. The regulations are a means whereby the Agency 
keeps itself informed of these changes in an employee's 
status. They provide a means of automatically ensuring 
that repeated reviews are made of an employee's security 
status throughout his career in the Agency. See paragraph 
_22 for a fuller treatment of this topic. 

c. Finally, and perhaps most important of all, the 
regulations protect the individual from inadvertently making 
himself vulnerable to the opposition. Security review of a 
proposed action enables the Office of Security to warn the 
employee of the possible hazard to his personal security 


that might result. 


PRE-EMPLOYMENT PROCEDURES 


5. In its search for new employees, the Agency resorts to 


a complex of mechanisms. designed to ensure that we get personnel 


of the highest possible quality. The first, or at least one of the 
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earliest, concerns is with the individual's qualifications--whether 
he is or is not equipped to do the job to which he might be assigned. 
If he lacks the qualifications sought, there is, of course, no further 
interest in him. If he does appear to have the necessary qualifica- 
tions, then we must discover whether he would be a suitable 
employee and whether he would be an acceptable security risk. 
Actually, little distinction can be made between suitability and 
security acceptability. There are applicants that are rejected 
solely on security grounds. More often, however, the weaknesses 
or vulnerabilities that might make an individual an unsuitable 
employee also disqualify him as an acceptable security risk. 

6. The first assessment of the potential employee is made 
by the recruiter. Once a candidate has been accepted as an 


applicant for employment, the Office of Security assumes respon- 


25X1 


sibility for security clearance. 
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ON-DUTY PROCEDURES 


12, We are convinced that the security climate of the Agency, 
so different from the individual's experience in civilian life, exercises 
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a positive influence on the attitudes and conduct of the new employee. 
The complex of physical security measures, to which the employee 
must conform, quickly become a part of his official life and induce 
in him a security consciousness that carries over into his private 
life. One of those whom we interviewed made the point that CIA 
employees have good security reflexes. He was thinking in terms 
of the fact that many of our people are working directly against 
the opposition and that all of us are fully aware that we are prime 
targets of the opposition. We believe that these favorable security 
reflexes stem in at least equal measure from the fact that dozens 
of times each day each employee is reminded of our security 
measures~-the badge that is habitually worn, the guards, the safes, 
the room checks, the secure telephones, the burn trash bag, and 
soon. A previous statement is worth repeating: the employee is 
never allowed to forget that CIA takes security seriously. 
The Responsibility of the Individual 

13, Each employee, whether at Headquarters or in the 
Field, is held responsible for conducting himself in an acceptable 
manner, Standards of conduct are prescribed in Hanaboo} | 25K1 
A related regulation requires that each employee read the personal 
conduct handbook semi-annually and certify that he has read it. 
We conclude that there is an acceptable degree of compliance with 
the requirement that the handbook be circulated to all employees 
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every six months. We suspect, however, that this has become a 
pro forma exercise in which the average employee certifies that 
he has read the handbook when in actual fact he is merely noting 
that it has passed through his hands again. Even though there 
probably is a high percentage of non-compliance with the require- 
ment that the handbook be read, we think it of value to continue 

to circulate it. The mere act of semi-annually calling to each 
employee's attention the fact that we have a regulation on personal 


conduct has a positive effect, 
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18, Although security is not specifically mentioned in the 
handbook on supervisory responsibilities, we doubt that this is a 
serious flaw. The handbook does make clear that the supervisor 
is expected to know his people. 

19. In our conversations with selected heads of offices, 
in each Directorate, we asked them to identify strong and weak 
supervisors in a variety of grades, without specifying which they 


considered to be strong and which to be weak. We then interviewed 
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these supervisors to discover whether they were familiar with 
security regulations, whether they understood them, and whether 
they thought the regulations to be effective. It might be noted that 
we had little difficulty in quickly discovering which were the strong 
supervisors and which were the weak. In general, we found that 
the strong supervisors did know and understand the regulations 
and required compliance with them. We also found that they knew 
the weaknesses and the strengths of the employees they supervised. 
Among the weaker supervisors, we found a generally lesser aware- 
ness of security requirements and a much less complete knowledge 
of the strengths and weaknesses of those they supervised. The 
most significant deficiencies in supervision, particularly as regards 
the extent to which the supervisor knew and understood Agency 
regulations, appeared among supervisors in the lower GS grades. 
20. Although weak supervision inevitably is a weakness in 
the Agency's security pattern, we believe that there are built-in 
safeguards that limit the damage that weak supervision can do. 
The supervisor-employee relationship does not operate in a vacuum. 
The weak supervisor in the lower grades is in turn supervised by 
various layers of supervisors of more experience and competence. 
Further, in most components there are support personnel who 
concentrate solely on the mechanics of administration and of manage- 


ment. They take up much of the slack caused by poor supervision. 
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31. Some years ago the Office of Security delivered to all 


Headquarters employees a security reindoctrination lecture. Although 
the lecture was, in effect, a rebriefing on security, it was so cleverly 


devised and so well presented that it was not looked upon by the 
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average employee as merely another "security lecture." A new 


reindoctrination program is now being put together and the 
presentations will begin in mid-November, 

32, Although the Office of Security is primarily concerned 
with security, per se, its normal day-to-day duties far exceed its 
written charter. We reviewed the weekly reports of the Personnel 
Security Division covering the four-year period from January 1959 
through December 1962, Based on our own past contacts with the 
Office of Security, we were aware that Security is often called 
upon to provide assistance to employees outside of the pure 
security field. We were amazed, however, at the extent of the 
assistance that Security renders to Agency employees. The range 
is virtually limitless and covers such things as assistance in case 
of accident, medical emergency, troubles with the police, housing, 
divorce, crank telephone calls, etc. 

33. It might be argued that such personal assistance often 
does not involve matters having security implications and that 
other elements of the Agency should be assigned such responsibilities. 
We are convinced, however, that Security's close involvement with 
the welfare of Agency employees is appropriate and that there is a 
direct security benefit. The Agency has a reputation for "protecting 


its own" and it is clear that much of this reputation derives from the 
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positive acts of the Office of Security. By extension, the Agency's 


reputation becomes, in large measure, the reputation of the Office 
of Security. The Office is respected by most employees and it is 
through its good reputation that it is able to accomplish its tasks 


as effectively as it does. 
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